Re: [PATCH 07/18] nvme-keyring: implement nvme_tls_psk_default()

Sagi Grimberg
2023-03-29T15:35:40Z

On 3/29/23 16:59, Hannes Reinecke wrote:
> Implement a function to select the 'best' PSK for TLS.
>
> Signed-off-by: Hannes Reinecke <hare@suse.de>
> ---
> drivers/nvme/common/keyring.c | 47 +++++++++++++++++++++++++++++++++++
> include/linux/nvme-keyring.h | 2 ++
> 2 files changed, 49 insertions(+)
>
> diff --git a/drivers/nvme/common/keyring.c b/drivers/nvme/common/keyring.c
> index 4ac33538f839..ca36a061bd48 100644
> --- a/drivers/nvme/common/keyring.c
> +++ b/drivers/nvme/common/keyring.c
> @@ -103,6 +103,53 @@ struct key *nvme_tls_psk_lookup(struct key *keyring,
> }
> EXPORT_SYMBOL_GPL(nvme_tls_psk_lookup);
>
> +/*
> + * NVMe PSK priority list
> + *
> + * 'Retained' PSKs (ie 'generated == false')
> + * should be preferred to 'generated' PSKs,
> + * and SHA-384 should be preferred to SHA-256.
> + */
> +struct nvme_psk_priority_list {

nvme_tls_psk_priority_list

> + bool generated;
> + enum nvme_tcp_tls_cipher cipher;
> +} nvme_psk_prio[] = {

nvme_tls_psk_prio

> + { .generated = false,
> + .cipher = NVME_TCP_TLS_CIPHER_SHA384, },
> + { .generated = false,
> + .cipher = NVME_TCP_TLS_CIPHER_SHA256, },
> + { .generated = true,
> + .cipher = NVME_TCP_TLS_CIPHER_SHA384, },
> + { .generated = true,
> + .cipher = NVME_TCP_TLS_CIPHER_SHA256, },
> +};
> +
> +/*
> + * nvme_tls_psk_default - Return 'best' PSK to use for TLS ClientHello

s/'best'/the preferred/...